Hi , when I'm deploying new changes to my services I want to compare the last day's error logs to the last week to see if there has been an increase for a specific message.  I have trouble figuring out how I display the counts for the different time ranges by message. This kind of gives the correct result but the same message for last and this week will not be grouped correctly.       sourcetype="my pod" level="error" | eval marker = if (_time < relative_time(now(), "-1d@d"), "lastweek", "thisweek") | multireport [where marker="thisweek" | stats count as this week by message] [where marker="lastweek" | stats count as last week by message]       Grateful for any help

if i have employees list .for each employee there are two status logged in and logged out, i need to find out the each users last status and if user last status is logged out i need to count how many employees get logged out

I want to see the result values of Src_ip and dst_ip are the same and "ok" and the number of these result values. What should I do? The code I made doesn't work well. index="my_index" |eval cheack=if(html_code==200,"error","OK") |stats list(src_ip) as src_ip list(dst_ip) as dst_ip by cheack |table src_ip , dst_ip , cheack , count  

Hi, is it possible for a checkbox with search on change enabled to only refresh one panel in a dashboard with multiple panels? Only that panel is using the input from the checkbox, so there's no need for all other panels to be refreshed when there are changes made to it. 

Is it valid to use a where clause to compare a string value to a multivalue field in order to know if that value is one of the values in the multivalue field?  For example,  my query returns this result where firstName is a multivalued field:   lastName | firstName -------- ----------- Smith | Amy, Barbara, Carol Wilson | Carol, Deanna, Emily   In my query I add the following to the end of my query to find all rows containing "Carol" in the multivalue field.   where firstName="Carol"     The where clause seems to work fine and returns all the row containing "Carol" in the multivalue field.  I'm wondering if its a supported syntax because I didn't find an example that looks like this and the various "mv" functions seemed to be for more complicated operations. In this example, I'm looking to get all last names and any associated first name and then use a where clause to return anyone with a particular first name.